Overview
overview
3Static
static
3webApp/app...e.html
windows7-x64
1webApp/app...e.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...b.html
windows7-x64
1webApp/app...b.html
windows10-2004-x64
1webApp/app...h.html
windows7-x64
1webApp/app...h.html
windows10-2004-x64
1webApp/app...t.html
windows7-x64
1webApp/app...t.html
windows10-2004-x64
1webApp/app...n.html
windows7-x64
1webApp/app...n.html
windows10-2004-x64
1webApp/app...s.html
windows7-x64
1webApp/app...s.html
windows10-2004-x64
1webApp/app...b.html
windows7-x64
1webApp/app...b.html
windows10-2004-x64
1webApp/app...t.html
windows7-x64
1webApp/app...t.html
windows10-2004-x64
1webApp/app...x.html
windows7-x64
1webApp/app...x.html
windows10-2004-x64
1webApp/app...one.js
windows7-x64
3webApp/app...one.js
windows10-2004-x64
3webApp/app...jzx.js
windows7-x64
3webApp/app...jzx.js
windows10-2004-x64
3webApp/app...gzx.js
windows7-x64
3webApp/app...gzx.js
windows10-2004-x64
3webApp/app...stx.js
windows7-x64
3webApp/app...stx.js
windows10-2004-x64
3Analysis
-
max time kernel
145s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-05-2024 11:13
Behavioral task
behavioral1
Sample
webApp/app/MobInfo/html/appIphone.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
webApp/app/MobInfo/html/appIphone.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
webApp/app/MobInfo/html/cjzx.html
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
webApp/app/MobInfo/html/cjzx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
webApp/app/MobInfo/html/ggzx.html
Resource
win7-20231129-en
Behavioral task
behavioral6
Sample
webApp/app/MobInfo/html/ggzx.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral7
Sample
webApp/app/MobInfo/html/ggzx_dstx.html
Resource
win7-20240220-en
Behavioral task
behavioral8
Sample
webApp/app/MobInfo/html/ggzx_dstx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
webApp/app/MobInfo/html/ggzx_lhb.html
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
webApp/app/MobInfo/html/ggzx_lhb.html
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
webApp/app/MobInfo/html/jh.html
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
webApp/app/MobInfo/html/jh.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
webApp/app/MobInfo/html/pdftest.html
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
webApp/app/MobInfo/html/pdftest.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral15
Sample
webApp/app/MobInfo/html/yaowen.html
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
webApp/app/MobInfo/html/yaowen.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral17
Sample
webApp/app/MobInfo/html/ywclass.html
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
webApp/app/MobInfo/html/ywclass.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
webApp/app/MobInfo/html/zb.html
Resource
win7-20240419-en
Behavioral task
behavioral20
Sample
webApp/app/MobInfo/html/zb.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral21
Sample
webApp/app/MobInfo/html/zt.html
Resource
win7-20240220-en
Behavioral task
behavioral22
Sample
webApp/app/MobInfo/html/zt.html
Resource
win10v2004-20240426-en
Behavioral task
behavioral23
Sample
webApp/app/MobInfo/html/zxgzx.html
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
webApp/app/MobInfo/html/zxgzx.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
webApp/app/MobInfo/js/appIphone.js
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
webApp/app/MobInfo/js/appIphone.js
Resource
win10v2004-20240226-en
Behavioral task
behavioral27
Sample
webApp/app/MobInfo/js/cjzx.js
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
webApp/app/MobInfo/js/cjzx.js
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
webApp/app/MobInfo/js/ggzx.js
Resource
win7-20231129-en
Behavioral task
behavioral30
Sample
webApp/app/MobInfo/js/ggzx.js
Resource
win10v2004-20240426-en
Behavioral task
behavioral31
Sample
webApp/app/MobInfo/js/ggzx_dstx.js
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
webApp/app/MobInfo/js/ggzx_dstx.js
Resource
win10v2004-20240508-en
General
-
Target
webApp/app/MobInfo/html/ggzx_dstx.html
-
Size
1KB
-
MD5
65389ed3826e5b660e7b58f8b72e03e2
-
SHA1
43399b70b092bdd14e21101d83efb6da398905c3
-
SHA256
87491b126f350c8c73466a2ca2eb987037fc829dddfc0473232134dba261426e
-
SHA512
501f76de3f0381a700ff2835dd9c2b8337ddc90f1d05168993aebea324d9d632339db3201008d45ad6adc9e246b28042bfb4a50b7f87a8426a142e8cf229467f
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exepid process 2456 msedge.exe 2456 msedge.exe 3372 msedge.exe 3372 msedge.exe 2108 identity_helper.exe 2108 identity_helper.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe 3896 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
Processes:
msedge.exepid process 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
Processes:
msedge.exepid process 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
Processes:
msedge.exepid process 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe 3372 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 3372 wrote to memory of 1448 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 1448 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 5068 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 2456 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 2456 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe PID 3372 wrote to memory of 4544 3372 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\webApp\app\MobInfo\html\ggzx_dstx.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe984946f8,0x7ffe98494708,0x7ffe984947182⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:22⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 /prefetch:82⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,13233615434378020942,16812804538009858883,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5ce4c898f8fc7601e2fbc252fdadb5115
SHA101bf06badc5da353e539c7c07527d30dccc55a91
SHA256bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
SHA51280fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54158365912175436289496136e7912c2
SHA1813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA256354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
SHA51274b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD58d2091bbcbf60880d7d27c3d375900a8
SHA11888b832cf44e1ad9643faa0420ff2588265e958
SHA25688219a89c5add8f17b112faec64dc6de7ca2217e48ee48d1feed13a9ba5b6532
SHA5123e5366ce3076199a414290ac08e01e1a204cc8a8dfe4d2cc9fd19e0a112cf945f9e76cbec86df6a5bbbd16094a9cdd9a616b6b80b21ac798bc32ac6c3eec230c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD54e04f421fd04416d5f840412ef996089
SHA18618e06223ebeb762a05b8ff90ed04af29bc0606
SHA25604c1fc54f4fd7281bd7feb526f623d362a4ecf51c295891a4a43ea7520f66f92
SHA51213a15283d5889cfea3f9fbb62211fb704d7ca6a1f0104b960427725927fdaeba58ba380d40a67f0e69bee58067ab30d00601d4930dbccb1e3deb5cb33867a2aa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD516a40cbc47e5cf76497763275bff7296
SHA1f19f3493659f5ece0360bb667925326a77d6b7eb
SHA25629802da4ae3603a488ea1b10eb40308ef9473423013be0d8c223d37b170c2959
SHA512b16e791ee9fe3e48026b3e2e02ad2e9ff8d3d72e5fbbad32246206c87e891e62ef050613af7687322f84efc01227e0ac2acc75fca860e5678fb255a9c8d4eeb9
-
\??\pipe\LOCAL\crashpad_3372_HITVSHVCHKIRZZUJMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e